Add admin UI toggle for OAuth dynamic client registration
What does this MR do and why?
Adds the admin area toggle for OAuth dynamic client registration (DCR, RFC 7591) under Admin > Settings > General > Account and limit.
The setting, its enforcement, and the application settings REST API were merged separately in the backend-only split !248615 (merged). This MR is now scoped to the admin UI only, so administrators can disable DCR from the UI instead of the API.
Implementation
This MR adds only the admin UI pieces:
- A checkbox (
dynamic_client_registration_enabled) in the account and limit settings form. - A JavaScript-driven destructive-action warning that appears when the admin unchecks the box, because disabling the setting deletes all dynamically registered OAuth applications and revokes their access tokens.
- Translation strings (
.pot). - A view spec for the partial.
The underlying setting (default true, stored in the oauth_settings
JSONB column), the POST /oauth/register enforcement, the OAuth
discovery-document gating, the cleanup-on-disable worker, and the REST
API attribute all live in master already via
!248615 (merged).
Screenshots or screen recordings
Setting in admin area when disabled:
Setting in admin area when enabled (default value):
How to set up and validate locally
Must be running GDK in Self-Managed mode (non-SaaS mode).
- Visit Admin > Settings > General > Account and limit.
- Confirm the Allow dynamic client registration checkbox renders and is checked by default.
- Uncheck it and confirm the destructive-action warning appears.
- Save and confirm the setting persists.
Related
- Resolves #601438
- Admin UI follow-up to the backend split !248615 (merged)